未能 send/receive 客户端证书从控制台应用程序到 Web api

Question

我创建了一个 Web Api 来接受客户端证书。
我正在使用以下代码从 console app 调用网络 api。

var uri = new Uri("https://myservice.azurewebsites.net/api/values");

var handler = new WebRequestHandler();

handler.ClientCertificateOptions = ClientCertificateOption.Manual;
var certResults = new X509Store(StoreLocation.LocalMachine);
var certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);

try
{
    certStore.Open(OpenFlags.ReadOnly);
}
catch (Exception)
{
    Console.WriteLine("Unable to access Certificate store");
}

var thumbprint = "<<self signed cert thumbprint>>";
var certCollection = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
certStore.Close();

HttpClient client = new HttpClient(handler);
if (certCollection.Count > 0)
{
    handler.ClientCertificates.Add(certCollection[0]);
    client.DefaultRequestHeaders.Add("Thumbprint", certCollection[0].Thumbprint);
}

var result = client.GetAsync(uri).GetAwaiter().GetResult();

Console.WriteLine($"status: {result.StatusCode}");    
Console.WriteLine($"content: {result.Content.ReadAsStringAsync().GetAwaiter().GetResult()}");    
Console.ReadLine();
}

在服务器端，我添加了一个中间件来获取证书详细信息。

{
    //var certHeader = context.Request.Headers["X-ARR-ClientCert"];

    var certificate = context.Connection.ClientCertificate;
    if (certificate != null)
    {
        try
        {
            //var clientCertBytes = Convert.FromBase64String(certHeader);
            //var certificate = new X509Certificate2(clientCertBytes);

            bool isValidCert = IsValidClientCertificate(certificate);
            if (isValidCert)
            {
                await _next.Invoke(context);
            }
            else
            {
                _logger.LogError("Certificate is not valid");
                context.Response.StatusCode = 403;
            }
        }
        catch (Exception ex)
        {
            _logger.LogError(ex.Message, ex);
            await context.Response.WriteAsync(ex.Message);
            context.Response.StatusCode = 403;
        }
    }
    else
    {
        _logger.LogError("X-ARR-ClientCert header is missing");
        context.Response.StatusCode = 403;
    }
}

我在本地机器和 Azure 应用服务上试过运行。我在 resources.azure.com 中将标志 clientCertEnabled 设置为 true。 Web Api 已启用 SSL。

但证书总是以 null 的形式出现
var certHeader = context.Request.Headers["X-ARR-ClientCert"]; 和 var certificate = context.Connection.ClientCertificate;.

我做错了什么？

提前致谢。

Answer 1

我自己正在研究其中的一些东西并看到你的问题，我想知道你是否遇到了 link Securing ASP.NET WebAPI using Client Certificates

中描述的问题之一

具体来说：

4 Add MyPersonalCA.cer to Local Machine -> Truted Root Certificate Authorities. This is key, espcially while you are developing and want to try things. If you don’t do it, Request.ClientCertificate won’t be populated because the cert chain is untrusted.

未能 send/receive 客户端证书从控制台应用程序到 Web api

Fail to send/receive Client Certificate from Console App to web api

c#

certificate

client-certificates

.net-core

asp.net-core-webapi